--- a/third_party/heimdal_build/wscript_build	2026-09-01 23:21:32.000000000 +0000
+++ b/third_party/heimdal_build/wscript_build	2026-09-01 23:21:32.000000000 +0000
@@ -411,7 +411,8 @@
 
     HEIMDAL_LIBRARY('kdc', source=KDC_SOURCE,
                         includes='../heimdal/kdc',
-                        deps='roken krb5 hdb asn1 HEIMDAL_DIGEST_ASN1 HEIMDAL_KX509_ASN1 heimntlm hcrypto com_err wind heimbase gssapi gss_preauth',
+                        deps='crypto roken krb5 hdb asn1 HEIMDAL_DIGEST_ASN1 HEIMDAL_KX509_ASN1 heimntlm hcrypto com_err wind heimbase gssapi gss_preauth',
+                        cflags=['-DHAVE_HCRYPTO_W_OPENSSL=1'],
                         version_script='kdc/version-script.map')
     HEIMDAL_AUTOPROTO('kdc/kdc-protos.h', KDC_SOURCE, options='-E KDC_LIB -q -P comment -o')
     HEIMDAL_AUTOPROTO_PRIVATE('kdc/kdc-private.h', KDC_SOURCE)
@@ -732,8 +733,8 @@
     HEIMDAL_LIBRARY('krb5', KRB5_SOURCE,
         version_script='lib/krb5/version-script.map',
                         includes='../heimdal/lib/krb5 ../heimdal/lib/asn1 ../heimdal/include',
-                deps='roken wind asn1 hx509 HEIMDAL_KX509_ASN1 hcrypto com_err HEIMDAL_CONFIG heimbase execinfo samba_intl HEIMDAL_IPC_CLIENT KRB5_CRYPTO' + krb5_keyutils_dep,
-                cflags=['-DLOCALSTATEDIR="/2"'] + bld.dynconfig_cflags(),
+                deps='crypto roken wind asn1 hx509 HEIMDAL_KX509_ASN1 hcrypto com_err HEIMDAL_CONFIG heimbase execinfo samba_intl HEIMDAL_IPC_CLIENT KRB5_CRYPTO' + krb5_keyutils_dep,
+                cflags=['-DLOCALSTATEDIR="/2"', '-DHAVE_HCRYPTO_W_OPENSSL=1'] + bld.dynconfig_cflags(),
                         )
     KRB5_PROTO_SOURCE = KRB5_SOURCE + ['lib/krb5/expand_path.c', 'lib/krb5/plugin.c', 'lib/krb5/context.c', 'lib/krb5/crypto.c']
 
@@ -1008,8 +1009,8 @@
     HEIMDAL_LIBRARY('hx509',
         HEIMDAL_HX509_OBJH_SOURCE + ' lib/hx509/sel-lex.l lib/hx509/sel-gram.y',
         includes='../heimdal/lib/hx509',
-        deps='roken com_err asn1 hcrypto asn1 HEIMDAL_OCSP_ASN1 HEIMDAL_PKCS8_ASN1 HEIMDAL_PKCS9_ASN1 HEIMDAL_PKCS12_ASN1 HEIMDAL_PKCS10_ASN1 wind heimbase',
-        cflags=bld.env.HEIMDAL_UNPICKY_WNO_STRICT_OVERFLOW_CFLAGS,
+        deps='crypto roken com_err asn1 hcrypto asn1 HEIMDAL_OCSP_ASN1 HEIMDAL_PKCS8_ASN1 HEIMDAL_PKCS9_ASN1 HEIMDAL_PKCS12_ASN1 HEIMDAL_PKCS10_ASN1 wind heimbase',
+        cflags=TO_LIST(bld.env.HEIMDAL_UNPICKY_WNO_STRICT_OVERFLOW_CFLAGS) + ['-DHAVE_HCRYPTO_W_OPENSSL=1'],
         version_script='lib/hx509/version-script.map',
         )
 
--- a/third_party/heimdal_build/wscript_configure	2025-06-04 09:08:46.000000000 +0000
+++ b/third_party/heimdal_build/wscript_configure	2026-09-01 23:21:32.000000000 +0000
@@ -218,3 +218,6 @@
     pass # TODO
 
 conf.CHECK_SIGN('time_t')
+
+conf.CHECK_HEADERS('openssl/evp.h openssl/ec.h openssl/ecdsa.h')
+conf.CHECK_LIB('crypto', shlib=True)